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ABSTRACT 

We propose a method called Fast and Realistic Attacker 
Modeling and Evaluation (FRAME) that can reduce pes¬ 
simism in static noise analysis by exploiting temporal logical 
correlation of attackers and using novel techniques termed 
envelopes and a functions. Unlike conventional pruning- 
based approaches, FRAME efficiently considers all relevant 
attackers, thereby producing more realistic results. FRAME 
was tested with complex industrial design and successfully 
reduced the pessimism of conventional techniques by 30.4% 
on average, with little computational overhead. 

Categories and Subject Descriptors 

B.7.2 [Integrated Circuits]: Design Aids— verification 
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1. INTRODUCTION 

Addressing noise issues in digital circuit design has be¬ 
come critical, due to the combined effects of technology 
scaling, high clock frequencies, and increased use of noise- 
sensitive dynamic circuits to fulfill high-speed requirements. 
Without thorough verification, noise effects will degrade the 
functionality, performance and reliability of a circuit. Most 
industrial static noise analyzers assume that all attackers 
switch simultaneously in the same direction, which frequently 
produces unrealistic results. Thus, pessimism reduction in 
static noise analysis has gained much attention HHSCM- 
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Most existing techniques exploit temporal and/or logical 
correlations among attackers. Early approaches mxnrn 
focused on timing correlations, which can be estimated by 
propagating timing windows through static timing analysis 
(STA). However, considering only timing correlations is in¬ 
sufficient. For instance, temporally uncorrelated attackers 
can still be under a logical constraint that prevents them 
from switching in the same direction. Moreover, overlook¬ 
ing the interplay between temporal and logical correlation 
could give non-conservative timing results [B] . Consequently, 
combined approaches that consider both temporal and log¬ 
ical correlations step-by-step [aMMOM] or simultane¬ 
ously HUMS] have been suggested. 

Most previous approaches aim at either pruning out in¬ 
valid attackers fTlRJlIBl fTiTlll 111 1311 16II20| or selecting appropri¬ 
ate attackers and constructing a set of valid attackers E-EO- 
The problem of handling temporal and logical correlations is 
in general NP-hard [5], and these combinatorial approaches 
depend critically on various techniques for alleviating the 
hardness, such as SAT solvers [3l 1 11 1IT31 116| . ATPG/path- 
sensitization |1I6I10I18| . ROBDDs |7I9I20| . and other heuris¬ 
tics m- Nevertheless, many techniques still suffer from 
limited scalability to large-scale circuitries. Moreover, not 
considering all attackers can sometimes increase pessimism, 
deviating from the common belief that pessimism can always 
be reduced by pruning attackers (e.g. see Section EJ. 

The proposed FRAME method is related to existing ap¬ 
proaches in that temporal and logical correlations are ex¬ 
ploited together. On the other hand, FRAME is unique in 
the following aspects: First, FRAME implicitly considers 
all attackers, rather than pruning out or selecting attackers. 
Second, FRAME exploits a simple, graphical representation 
of attacker waveforms for exploring the search space with¬ 
out explicit enumeration of all possibilities. Taken together, 
FRAME runs fast and produces realistic results since the ef¬ 
fect of every relevant attacker is simultaneously considered. 

In a verification flow, FRAME would be positioned as 
a first-level noise estimator that can quickly examine large 
circuits and identify noise issues for more accurate analy¬ 
sis. Toward that end, FRAME exploits novel techniques 
termed envelopes and a functions, which enable us to com¬ 
pute the worst-case combined waveform of multiple attack¬ 
ers and their alignment information in time polynomial to 
the number of attackers, under reasonable assumptions on 
attacker waveform shapes and secondary attacker effects. 
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Figure 1: Attacker modeling. 


We extensively tested FRAME with 201 circuits extracted 
from a millon-gate 90-nm industrial design and discovered 
that FRAME can reduce pessimism by 30.4% on average, 
compared with conventional pruning-based techniques, with 
little computational overhead. Based on our promising re¬ 
sults, we believe that FRAME can be a practical and pow¬ 
erful tool for facilitating the entire verification flow. 


2. PROPOSED METHOD 

2.1 Attacker Modeling and Assumptions 


Consider a chain of buffers and inverters whose nets ( at¬ 
tackers ) are capacitively coupled with a common net (vic¬ 
tim), as shown in the left pane of Fig. 1(a) The input to the 
first gate in the chain is referred to as the chain head. As the 
chain head (and its downstream gates thereafter) switches, 
the victim, which is assumed initially static, can be affected 
and dynamically change. We are interested in how individ¬ 
ual attackers interact to create a composite waveform at the 
victim. Of particular interest is the worst-case combination 
that contains a peak of the largest magnitude. 

Since the attackers on the chain are temporally and log¬ 
ically correlated, the worst-case search problem becomes 
computationally hard [5J. To alleviate that, we break the 
chain, apply separate input to each attacker block to induce 
an attacker bump, and estimate the original combined wave¬ 
form using these bumps, as in Fig. 1(a) Temporal corre¬ 
lation among attackers is considered using timing windows, 
each of which is obtained through STA and provides the ear¬ 
liest a nd lat est arrival time of an attacker bump, as shown 
in Fig. 1(b) Logical correlation is considered using the po¬ 
larity of attacker bumps. 

For computational efficiency, FRAME assumes the follow¬ 
ing: (A.l) A single attacker waveform is piecewise linear and 
unimodal. It is thus modeled by a triangular wave; (A.2) 
The input slew of each attacker is fixed within its timing 
window; (A.3) The effects of secondary attackers (i.e. an 
attacker of an attacker) are marginal and can be ignored. 

Based on (A. 1-2), we model each attacker bump by a tri¬ 
angle with four stationary parameters, as shown in Fig. 11(c)] 


f iil<t<p; 

A (t;l,p,e,m)= <=z±(t-e), if p < t < e; (1) 

I 0, otherwise. 

For simplicity, we set l = 0 and approximate fi ( t ), the wave¬ 
form of attacker i, by A(f; 0 ,pi,ei,rm). The timing window 
of attacker i is represented by interval [m,bi], where at and 


Algorithm 1 The FRAME method 

input: © = (p, e, m, a, b) for each attacker bump 
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output: W* and S* 
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Construct envelopes E 
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Derive a function from E 
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Represent E and cr by vertices 
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end for 
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Calculate W* and S* 

> Section |2.6| 
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end procedure 



bi indicate the earliest and latest arrival time, respectively. 
For convenience, let &i = ( pi,ei,nn,ai,bi ) for attacker i. 


2.2 The Objective and Overview of FRAME 


Given a chain of n attackers, let W be the magnitude 
of the composite waveform of the n attackers and Si the 
time amount by which attacker fi(t) should be shifted to 
produce W. Let S = {si, S 2 , ■ • •, s n } and assume a function 
J : R" —> R, where R denotes the set of all real numbers. 
FRAME is to determine the worst-case magnitude 


W = max 

t 




= J( S) 


( 2 ) 


and an instance of the corresponding attacker alignment 


S* = argmax J(S) (3) 

under the constraints that Si € [at,bi ] for i = 1,2 
Using W *, we would be able to identify noisy nets that need 
further analysis. High-accuracy simulators can be invoked 
with the alignment information S*. 

Eqs. (EEl) might be solved by conventional search algo¬ 
rithms or by a dynamic programming argument if discrete¬ 
time waveforms are assumed. However, such approaches 
would be overkill given that only an instance of the worst- 
case solution would suffice for typical static noise analysis. 
Furthermore, the uniqueness of the solution to the above 
equations not being guaranteed, such approaches may incur 
excessive running time with little gain. FRAME provides a 
rapid solution to the above equations by following the proce¬ 
dures outlined in Algorithm [I] Note that FRAME typically 
needs to be invoked twice per chain, once for each direction 
(i.e. rising and falling) of the chain head input, since the 
attacker parameters change according to this direction. 


2.3 Tracing the Worst Case By Envelopes 

We utilize the notion of envelopes to determine efficiently 
the magnitude of a worst-case composite waveform. Infor¬ 
mally, an envelope is a waveform that represents the maxi¬ 
mum or minimum voltage observable at each time point, as 
an attacker waveform is slid over its timing window. The 
idea of using an envelope has some resemblance to the work 
by US], but the envelope we propose is more general and 
powerful in that both maximum and minimum values can 
be tracked and that alignment information is accompanied. 

For a more precise definition, consider Fig. |2(a)] that shows 
the trajectory of an attacker waveform over its timing win¬ 
dow. Assume that f(t) = A(t;0,p, e,m) and that / can be 
shifted by s € [a,b]. For the sake of explanation, also as¬ 
sume that b < a + e. Consider the probe point at time t = t x 
in Fig. |2(a)| The vertical arrow then indicates the range of 
voltage values that can be measured at t x , as s varies from 
a to b. The maximum voltage observable at t x is ^(t x — a), 




























Table 2: The a functions we use (S = a+e e b ). 



Zone 

2 

3 

4 

5 

6 

7 

Max 

fit ~a) 

m 

f^it-e-b) 

Min 

0 


f^it-a-e) 

0 


(b) Computing max/min at t x depends on time zone 


For Fouter (^) • 

For Firmer (£)• 

1 

<r(t;0) = 

a, if t < a; 

t, if a < t < 6; 

b, otherwise. 

a(t;Q) = 

(b, if t < b + p<f; 

| a, otherwise. 

a(t;0) = 

( b, if t < &; 

1 a, otherwise. 

See Fig. 5(a) 

5(b)| b < a + e 

5(c) b > a + e 


Figure 2: Concept of envelopes. 


Table 1: The meaning of outer/inner envelopes. 


Wave 

Outer envelope 

Inner envelope 

Positive 

max trace: Fig. 

3(a)| 

min trace: Fig. 02b), (c) 

Negative 

min trace: Fig. 

4(a) 

max trace: Fig. [4{b),(c) 


which happens when s = a. Similarly, the minimum voltage 
should be 0, which is achieved when t x < s < b. (Recall 
that we are varying s over fixed t x .) 

Above we assumed that t x is in zone 2 or a < t x < b\ 
by varying t x over the entire time horizon and recording the 
maximum and minimum at every t x , we obtain envelopes. 
As summarized in the table in Fig. |2(b)[ the formula to 
compute the minimum and maximum values observable at 
t x varies depending upon where t x is placed. The second 
line of the table lists the formula to get the maximum for 
each time zone. For the minimum, the relative locations of 
b and a + e also matters. The third line shows only the 
formula to calculate the minimum for b < a + e; otherwise, 
the minimum is always zero. The entries for zones 1 and 8 
are not shown in the table since the values are all zero. 

Now we formally define two types of envelopes — outer 
and inner envelopes. The outer envelope E ou t er of attacker 
f(t) represented by A(t;0,p, e, m) is a function of time t 
parameterized by © = ( p,e,m,a,b ): 


-Eouter (U ©) 


-^(t — a), if a<t<a+p; 

m, if a + p < t < b + p; 

f=%(t-e-b), if b + p < t <& + e; 
0, otherwise. 


For a positive waveform (m > 0), the outer envelope is the 
trace of the maximum, as shown in Fig. 3(a) For a negative 
waveform (m < 0), the outer envelope is the trace of the 
minimum, as shown in Fig. 4(a) The inner envelope of an 
attacker can have one of the two shapes, depending upon 
the parameters and timing window used: 

„ ,, J A (t; b, b + p5, a + e,mS ), if b < a + e; 

Firmer (U “) — ^ „ ,1 

0, otherwise. 


where S = a +^ b . The inner envelope of a positive waveform 
traces the minimum of the waveform. If b < a + e, the inner 
envelope has a triangular shape as shown in Fig. |3(b)1 other¬ 
wise, the inner envelope is always zero as shown in Fig. |3(c)| 
The inner envelope of a negative waveform traces the max¬ 
imum of the waveform as shown in Fig. |4(bJ| and [4(c)] Ta¬ 
bic [I] summarizes the meaning of outer and inner envelopes 
for positive and negative waveforms. 


2.4 Recording Shift Amount by a Function 

The FRAME method provides not only the magnitude 
of a worst-case combined attacker waveform but also the 
corresponding attacker alignment. Using this alignment in¬ 
formation, high-accuracy simulators can be invoked for fur¬ 
ther analysis. Each FRAME envelope is accompanied by 
the time-shift information named the a function. Recall in 
Fig. 2(a) the maximum voltage at t x is achieved when at¬ 


tacker / is shifted by s = a. Informally, the a function is to 
record this shift information for every point on an envelope. 

The shift amount s that makes the voltage at t x maximum 
or minimum is sometimes not unique. For instance, the 
minimum at t x can be achieved as long as t x < s < b in 
Fig. |2(a)1 This fact can be represented more formally by R a , 
a binary relation from R to [a, 6] such that R a = {(t, s)\f(t — 
s) = E(t)} for t G R and s G [a, 6]. That is, for any given t, 
R a provides the set of all values by which an attacker should 
be shifted to have the maximum or minimum value recorded 
on its envelope. The gray areas and nonzero lines in each 
subplot of Fig. 0 represent the R a relation for each of the 
envelopes shown in Fig. [3] and [4] 

Since we aim at finding some (not all) instances of the 
worst-case alignment, we do not use R a as it is but derive a 
function a : R —> [a, 6] from the R a relation. It is this a(t) 
function that is used in the downstream procedures. The 
thick bold line segments drawn in Fig. |5(a)| represent our 
choice for a(t) for the outer envelopes presented in Fig. 3(a) 
and|4( aj| Note that this arbitrary choice does not compro¬ 
mise the correctness of the solution we find; introducing a 
functions helps enhance computational efficiency by limiting 
the search space. Fewer solutions would be found by adopt¬ 
ing a, but the number of solutions is not important in our 
context. The a function we adopt for the inner envelopes 
presented in Fig. 3(b) and 4(b) is indicated by dark lines in 
Fig. 5(b) Finally, the thick bold lines in Fig. 5(c) repre¬ 


sent the S function of our choice for the inner envelopes in 


Fig. 3(c) and 4(c) Table [5] summarizes the formulae for the 


a functions we use. 


2.5 Representing Envelopes and a Functions 

The piecewise linear assumption enables us to represent 
an envelope only by the vertices joining line segments. For 
instance, the outer envelope drawn in Fig. |3(a)] can be repre¬ 
sented by using the four vertices shown in Fig. 6(a) In this 


manner, we can avoid handling an envelope in its continuous 
form; any intermediate values can be deduced from the ver¬ 
tices used. Similarly, we can save the need to manipulate the 
whole a function by annotating each vertex with its a value. 
Each vertex in our representation thus has four attributes 
denoted by tuple (t, V,[sl, sh]), where t and V represent the 

















































































time and voltage associated with the vertex; sl and sr are 
the left and right limits of a at t\ sl = lim e ^ 0 - a(t. + t) 
and Sr = lim e _ ) . 0 + a(t + e). Storing both limits is to han¬ 
dle the discontinuities appearing in the a functions for in¬ 
ner envelopes. FRAME represents each attacker waveform 
and its timing window compactly by using these annotated 
vertices. Fig. [S] shows the representations of the outer and 
inner envelopes presented in Fig. [3] The representations of 
the envelopes in Fig. [4] are similarly defined and not shown. 

2.6 Calculating the Worst-case Waveform 

The last step of FRAME is to manipulate envelopes and a 
functions to determine the worst-case composite waveform 
and attacker alignment. Since the envelope of an attacker 
waveform represents the maximum or minimum voltage for 
each time point, adding the envelopes of multiple attackers 
reveals the maximum or minimum voltage of the combined 
waveform of these attackers. More precisely, the worst-case 
magnitude W* of a combined waveform is given by 

W* = max{|_E ma x(i)|, |£ min (t)|} (4) 

where E max (t) and E m in(t) represent the envelopes to find 
the maximum and minimum voltage, respectively. For a 
positive (negative) attacker, its outer (inner) envelope rep¬ 
resents the maximum value. Thus, E max (t) is simply the 
sum of all positive outer and negative inner envelopes. Sim¬ 
ilarly, E m i n (t) can be calculated by adding all positive inner 
and negative outer envelopes. More precisely, 

E max (t) = ^2 E ou ter(i;©i) + E £inner(t;©i) (5) 
iei+ iei~ 

-^min (*) = E -dinner (t ] ©i) + E ^°uter (t; ©i) (6) 

<61+ <6l - 

where I + = {i|m< > 0}, I = {i|m< < 0} and |I + | + |I~| = n. 
The worst-case alignment s * of attacker i is given by 

s* = Oi (t*) , where (7) 

t* = argmax{|E max (t )|, |E min (t)|} (8) 

for i = 1,2,... ,n. Using the representation described in 
Section 1231 we can add envelopes simply by manipulating 
the attributes of the vertices used in the representation. We 
use the following example for further explanation. 

Example 1. Fig. 0a) shows two attacker waveforms in 
the left column. They are converted to the vertex-based en¬ 
velope representations in the right column and then added 
to E max (t). Fig. 0b) lists the attribute of each vertex 
before addition. An empty vertex attribute tuple of an at¬ 
tacker means that this vertex does not appear in the rep¬ 
resentation of the attacker. Before addition, these empty 
attributes get filled with values linearly interpolated using 
existing vertex attributes. For instance, Fig. 0(c) shows 
that the V 2 voltage of attacker 1 is set to the average volt¬ 
age of vi and V 3 marked by hexagons; the sl and sr of the 
new V 4 vertex is set to the average of sr of V 3 and sl of 
vs marked by a rectangle and an ellipse, respectively. In¬ 
terpolated entries are marked with asterisks. The ‘Sum’ 
column shows the result of addition. The voltage of a ver¬ 
tex in the result is the sum of the voltage attributes of the 
vertices of attackers 1 and 2. Fig. 0d) shows Emi n (t) ob¬ 
tained by switching the roles of outer and inner envelopes. 
Since |E m i n | > |E max |, W* = |-E m in| = 3. Note that there 
are three instances of t *. Fig. 0e) presents the worst-case 
waveform fi(t — s*) + fzfy — s?), where s* = cri(f* = 5) = 1 


and S 2 = 02 (t* = 5) = 2. The other cases for t* = 3 and 4 
are not shown due to the space limit. □ 

The addition algorithm used in the above example can 
easily be extended to adding multiple envelopes: Given n 
envelopes, we first sort the vertices of all envelopes with 
respect to t and merge them into a single master vertex 
list. We annotate each vertex in the list with a chain of n 
attribute tuples, one for each attacker envelope. For each 
attacker, we examine its chain of attribute tuples and in¬ 
terpolate any empty entries. Finally, for each vertex in the 
master list, we compute its voltage attribute by accumu¬ 
lating the voltage over the chain of attribute tuples. The 
worst-case complexity of the algorithm to add multiple en¬ 
velopes is 0(nlogn + 4n • n + 4n • n) = 0(n 2 ). 


3. EXPERIMENTAL RESULTS 

FRAME was implemented with C++ and was tested with 
various synthetic and real circuits. Experiments were per¬ 
formed on a 64-bit 2.66-GHz Linux machine with 8-GB mem¬ 
ory. For comparison, we used a commercial static noise an¬ 
alyzer that employs conventional pruning techniques PKH51 
l9l fl7Hl9l . Throughout the experiments, FRAME remained 
conservative and did not produce optimistic noise figures. 
The runtime overhead was less than 1% in all test cases. 

We first use a synthetic circuit shown in Fig. UK a) to ex¬ 
plain the pessimism reduction mechanism FRAME relies 
on. To generate reference data, SPICE is invoked (without 
breaking the chain) for simulating the victim waveform when 
the chain head falls. Using the timing windows and triangu¬ 
lar parameters obtained through STA, FRAME predicts the 
alignment of individual attackers, while the commercial tool 
we used performs pruning. The result is shown in Fig. [81(b), 
which compares the accuracy of FRAME and the pruning- 
based commercial tool with respect to SPICE. The peak 
voltage SPICE, FRAME and the competing tool report are 
0.3390V, 0.3398V and 0.4144V, respectively. FRAME thus 
reduces pessimism by 18.0% with respect to the competing 
tool. The FRAME waveform resembles the SPICE curve 
more closely, producing 93.6% smaller mean squared error. 
This difference originates mainly from the fact that the in¬ 
dustrial tool eliminates the second attacker because the di¬ 
rection of the second attacker bump is the opposite to that 
of the others. In other words, retaining the second attacker 
cannot be the worst-case since removing it induces larger 
noise, and the commercial tool prunes it. In contrast, the 
effect of all attackers are considered by FRAME. 

We extensively tested FRAME with 201 circuits extracted 
from a 90-nm network processor design with approximately 
1 million gates. Fig. |9(a)| compares the performance of 
FRAME with that of the commercial tool in terms of the 
worst-case peak voltage. For each dot at ( x, y), x and y rep¬ 
resents the worst-case peak voltages estimated by the com¬ 
mercial tool and FRAME, respectively. FRAME could re¬ 
duce pessimism significantly, by 30.4% on average, compared 
with the pruning-based industrial tool. The distribution of 
the pessimism reduction amount is shown in Fig. 9(b) | in 
which a boxplot is used for showing the median (the line 
inside the box) and interquartile range Q2] . This plot shows 
that FRAME typically reduces pessimism around 20-45% 
for the 201 circuits we tested. 

To prove further the statistical significance of our result, 
we performed the Mann-Whitney-Wilcoxon test m , a non- 
parametric test for assessing whether two sample sets come 
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Figure 3: Outer and inner envelopes for a positive attacker waveform (<5 = a+e e b ). 
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Figure 5: Relation R a and function a(t) for the envelopes in Fig. [3] and Fig. |4j 
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(b) Accuracy comparison 

Figure 8: Pessimism reduction by FRAME. 


from the same distribution. According to this test, we could 
reject the hypothesis that two groups of worst-case peak 
voltage observations (one from FRAME; the other from the 
commercial tool) come from the same distribution at the 
0.01% significance level with p-value of 2.85 x 10 -10 . This 
result indicates that the observed difference in noise figures 
is statistically significant and meaningful. 


[3] D. Chai, A. Kondratyev, Y. Ran, K. Tseng, 

Y. Watanabe, and M. Marek-Sadowska. 
Temporofunctional crosstalk noise analysis. In Proc. 
IEEE/ACM DAC, pages 860-863, June 2003. 

[4] L. H. Chen and M. Marek-Sadowska. Aggressor 
alignment for worst-case crosstalk noise. IEEE TCAD, 
20(5):612-621, May 2001. 

[5] P. Chen and K. Keutzer. Towards true crosstalk noise 
analysis. In Proc. IEEE/ACM ICC AD, pages 132-137, 
November 1999. 

[6] D. Das, K. Killpack, C. Kashyap, A. Jas, and 

H. Zhou. Pessimism reduction in coupling-aware static 
timing analysis using timing and logic filtering. In 
Proc. ASPDAC, pages 486-491, March 2008. 

[7] A. Glebov, S. Gavrilov, D. Blaauw, V. Zolotov, 

R. Panda, and C. Oh. False-noise analysis usng 
resolution method. In Proc. ISQED, pages 437-442, 
March 2002. 

[8] A. Glebov, S. Gavrilov, R. Soloviev, V. V Zolotov, 

M. R. Becer, C. Oh, and R. Panda. Delay noise 
pessimism reduction by logic correlations. In Proc. 
IEEE/ACM ICC AD, pages 160-167, November 2004. 

[9] A. Glebov, S. Gavrilovand, D. Blaauw, and 
V. Zolotov. False-noise analysis using logic 
implications. ACM TODAES, 7(3):474-498, July 2002. 

[10] H. Lee and J. Kim. False aggressors pruning using 
path sensitization and logic implications. In Proc. 
ASPDAC, pages 278-281, August 2004. 

[11] M. Palla, J. Bargfrede, K. Koch, W. Anheier, and 
R. Drechsler. Adaptive branch and bound using SAT 
to estimate false crosstalk. In Proc. ISQED, pages 
508-513, March 2008. 


4. CONCLUSION AND FUTURE WORK 

We have proposed FRAME, a fast and realistic method 
for modeling and evaluating multiple attackers in static noise 
analysis. The key difference between FRAME and conven¬ 
tional methods is that FRAME does not prune attackers 
completely but estimates the effect of all attackers without 
much computational burden, leveraged by efficient track¬ 
ing of the worst-case magnitude and alignment information 
using envelopes and er functions. According to our experi¬ 
ments, FRAME can reduce pessimism by 30.4% on average 
compared with conventional pruning-based attacker filtering 
techniques. Based upon our results, we believe that FRAME 
would be a very effective tool for pessimism reduction in 
static noise analysis. 

FRAME can be extended so that it can handle more com¬ 
plex attacker structures such as multiple attacker chains. 
For higher accuracy, it would be helpful to employ non-linear 
interpolation for envelope addition and to model waveform 
widths more delicately. 
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